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MEMORANDUM FOR THE RECORD 

1 . (U) Event. On August 26, 2003, Commissioner Ben-Veniste asked where it was documented 
that shootdown authority on September 1 1, 2001 resided with the President. Following is a 
preliminary paper that documents initial research conducted to answer that question. 



Executive Summary. The President’s authority is probably not statutory and would be 
contained in NSC documents, according to persons so far consulted. By 1046 EDT General 
Eberhart had clear shootdown authorit y by virtue of JCS declaration of DEFCON 3 which, by 



policy, put Transitional ROE in place. 

| | By 1012 bDT JCS, and by extension NORAD, had verbal authority from the VP 

to take out aircraft threatening Washington DC. Prior to that, at least one CONR Sector 
(Western) asked for ROE clarification. CJCS and NORAD standing rules-of-engagement were 
written with an external threat in mind. Internal language, however, appears to give CINC 
NORAD latitude apart from the National Command Authority (NCA). CJCS defines the NCA 
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to be the President and the SECDEF. 


Logs and transcripts reflect that 




he took positive action not to do so at 0913 (based on WTC events), 0940 (based on report of 
hijack out of JFK headed for DC) and 0948 (based on explosion at Pentagon) EDT, but did do so 
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at 0959 EDT (after White House interest), 
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3. (U) Methodology. Three avenues were pursued. First, calls were made or received from 
selected individuals. Second, Rules-of-Engagement documents received from DoD/JCS were 
reviewed. Third, relevant information concerning September 1 1 was extracted from documents 
received to date. Staff has not yet seen the Air Threat Conference Call transcript. 

4. (FOUO) Calls made and received. 

• Stewart Aly, DoD OGC, opined that there was nothing in Title 10 USC that spoke to 
such Presidental authority. If the authority was in writing it would likely be in NSC 
documents. 

• Dan Marcus, Commission General Counsel, based on calls he made, also observed that 
the Presidential authority was likely not contained in statutes and that NSC documents 
would be the most likely source. 

• Sam Brinkley and Dana Hyde, Commission Staff, both assessed that such authority 
resided in the President’s role as Commander-in-Chief and the oath he took to protect 
and defend the nation. 

5. (U) Rules of Engagement. (Emphasis Added) 

(U) Chairman of the Joint Chiefs of Staff Instruction 3 12 1.01 A, 15 January 2000, “Standing 
Rules of Engagement for US Forces” was in effect on September 11, 2001. (DoD document 
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delivery number NCTOO 10924) The instruction established “SecDef-approved standing rules of 
engagement (SROE) that implement the inherent right of self-defense and provide guidance for 
the application of force for mission accomplishment.” 

(U) The instructions apply to US forces during military attacks against the United States 
and during all military operations, contingencies, and terrorist attacks occurring 
outside the territorial jurisdiction of the United States. 

(U) Peacetime operations conducted by the US military within the territorial jurisdiction 
of the United States are governed by use-of- force rules. . .determined on a case-by-case 
basis. 

(U) For purposes of the instruction Commander, US Element NORAD, is referred to as a 
CINC. 

(U) The NCA approve ROE for US Forces. NCA is later defined in an attached 
glossary as: “The President and the Secretary of Defense or their duly deputized 
alternates or successors. Also called NCA.” 

(U) It is policy that “these rules do not limit a commander’s inherent authority and 
obligation to use all necessary means available and to take all appropriate actions in 
self-defense of his unit and other US forces in the vicinity. 

jJZ) The authority to exercise national self-defense resides with the NCA and CINCs who 
“within their designated areas of responsibility, have the authority to declare forces 
hostile.” [Note: this begs a question since the instruction considers the NORAD 
Commander to be a CINC.] 

As noted above, the instruction does not pertain to peacetime operations. Yet, the 
instruction also provides the following euida nce to “a commander having air-defense 
responsibilities.” He may direct engagement 
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6. (U) That poses the question of whether or not the nation was at war on the morning of 
September 11, which leads to the distinction between Peacetime, Transition and Wartime ROE 
as contained in APPENDIX 13 to ANNEX C to CINCNORAD CONPLAN 3310-96 (U), 
“RULES OF ENGAGEMENT (ROE) (U) [as amended on 24 September 1999] 

Peacetime ROE apply during NORAD DEFCON 5 and 4. 

CINCNORAD retains the authority to declare forces “hostile” and order engagements 
when Peacetime ROE apply. “Hostile Force” is defined by CJCS to be “any civilian, 
paramilitary, or military force or terrorist(s), with or without national designation, that 
has committed a hostile ac t, exhibited hostile intent, or has been declared hostile by 
appropriate US authority.” 
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Transition ROE apply during NORAD DEFCONs 3, 2, or 1. 
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‘‘airborne objects’' 



which are participating in or indicate clear intent to participate in an attack against the US 
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or Canada. I E.0. 13526, section 1.4(a) I have emergency authority to declare 

forces, “hostile” and, if necessary, to order engagements if in their judgment an actual 
attack is under way against the US or Canada. “Airborne objects” is later defined to 
include aircraft, missiles, and UAV. 



J CINCNORAD may direct wartime ROE at DEFCON 1. 



-(e) 
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may, 



if necessary to mount a defense against a surprise attack, implement Wartime ROE before 
binational command authorities have declared war. Wartime ROE are automatically 
implemented for NORAD upon CINCNORAD’s declaration of Air Defense Emergency 
(ADE) or for individual sectors or regions by a sector or region commander’s declaration 
of Air Defense Warning (ADW) RED. These declarations may be made anytime the 
situation r equires, based on the judgment of the commander concerned,' regardless of th e 
DEFCON. ~ 
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7. (K) A reading of the NORAD document gives the sense that it was written for an attack 
expected from off shore. However, there appears to be no precluding language concerning an 
attack from within. A reading of the NORAD and JCS documents, combined, give the sense that 
“shootdown authority” may have existed at a level below the NCA, depending on how the 
developing situation was interpreted. That leads to an examination of information gleaned from 
documents received to date. Following is a chronological listing of events as captured in logs 
and transcripts reviewed to date, [all entries are considered to be SECRET until context for a 
lower classification can be established. All entries are EDT] 



0913: The NORAD Missile Warning Center notes that two large passenger planes 
crashed into the WTC. CINCNORAD assessment was not necessary 

0915: The NMCC chronology establishes that CIA convened a NOIWON 



0920: The NMCC chronology reflects that the Assistant Deputy Director for Operations 
directed a Significant Event Conference (SIEC) with the CINCs and the Services 

0925: The Secret Service timeline reflects that an open line with FAA Presidential 
Operations was established 

UNK: The NORAD Command Director log has an in sequence but untimed notation that 
“VP directs that any threat aircraft over DC may be engaged. [Note: this is an anomaly] 

0933: The NMCC chronology establishes that NORAD requested an Air Threat 
Conference and the DDO concurred 



0934: The NMCC chronology reflects that the SIEC was dropped 

0939: The NMCC chronology notes that the DDO entered the ATC, possible threat to 
CONUS 



0940: The NMCC chronology contains a NORAD-related entry: “conflicting FAA 
reports on hijacks, one out of JFK enroute DC, no assessment. CINCNORAD not 
declaring Air Defense Event, recommends reconvene when more info available” 



0943: The NMCC chronology contains an entry: 
instructions, is told to prepare to evacuate VP” 



asks PEOC for 
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0943: The NMCC chronology shows that the National Air Operations Center (NAOC) 
secondary aircraft is airborne out of Andrews [Note: this may be WORD ONE or 
SWORD ONE, as reflected in Andrews flight strips of that day] 



0944: The NMCC chronology 
on alert 



shows that the PEOC instructed 



to remain 
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0948: The NORAD Missile Warning Center Log records a Pentagon explosion, 
Cheyenne MT is in force protection bravo, worldwide force protection alpha. 
CINCNORAD assessment was not necessary. 



0949: The NMCC chronology shows that CINCNORAD directed all air sovereignty 
aircraft to battle stations - fully armed 

0950: The NORAD Command Director Log notes that Exercise Global Guardian was 
cancelled per NORAD J3 



0955: The NMCC chronology notes that AFOPS reported that the White House requested 
fighter coverage, NORAD will process and provide ETA 

0955: The Joint Surveillance System radar files show that Air Force One is airborne 



0958: The NMCC chronology notes that WHCA broke int o conference and told DDQ to 
stand by— COL ? from PEOC relays request from Hadley: 
fighter escort for President, fighter CAP over DC 
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0959: The NMCC chronology and the NORAD Command Director Log both note that 
CINCNORAD assesses concern 



0959: The NMCC chronology contains a cryptic entry, without explanation: “EA goes to 
box, ADDO confirms, then holds. Box is not opened.” 

1000: The CONR chat transcript records that White House has directed fighter coverage 
over the White House 

1010: The Joint Surveillance System radar files show that AF One diverted to the west 

1011 : The CONR chat transcript reflects that WADS [Western Air Defense Sector} 
asked “What ROE are we working under” 

1012: The NMCC chronology notes that the PEOC directs NAOC airborne 

1012: The NMCC chronology records that “PEOC COL ? states “VP has directed that 
fighters can confirm a/c is hijacked they are cleared to take it out” 

1014: The CONR chat transcript reflects that WADS requested an ATO (Air Tasking 
Order) change real world requesting to load “slammers” 

1014: The CONR chat transcript reflects that the CONR DCO told WADS/SEADS 
(Southeast Air Defense Sector) to “bring up with live missiles, cleared to load slammers” 

1016: The NMCC chronology records that PEOC confirms that VP has cleared a/c to 
engage any a/c inbound to DC without authorization 

1016: The CONR chat transcript records that CONR DCO established “Peacetime ROE 
still 
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1018: The NMCC chronology records DDO telling PEOC UA93 is reported crashed in 
PA. PEOC asks that VP wants to know if it is a result of fighter engagement DDO asked 
NORAD to confirm how a/c went down. NORAD has no info on engagement FAA has 
no info 

1024: The CONR chat transcript records the WADS Director of Operations telling 
CONR he got the word on armament, more than guns. Can you please help us with ROE 

1025: The Secret Service timeline shows that the VP protection detail notified that VP 
has directed military to shoot down the a/c if it gets too close to the WH 

1026: The NORAD Air Warning Center Log reflects that CONR said present set of a/c 
has guns, next set will have missiles. The CONR chat transcript records that CONR DCO 
told WADS, “still peacetime ROE, NCA working modifications” 

1030: The Secret Service timeline reflects a collective decision to not return POTUS to 
WH until conditions in WDC stabilize 

1030: The NMCC chronology reflects that Steve Hadley wants to get word to VCJCS 
that there is an aircraft 5 miles out and that the VP’s guidance is to take it out. 

1031 : The CONR chat transcript records that VP has cleared us to intercept tracks of 
interest and shoot them down if the do not respond, per CONR 

1032: The NMCC chronology reflects that Hadley added that any information about the 
a/c that can be gathered before you have to take it out would be useful 

1034: A JCS chronology reflects that MG Ward discussed “authority” and “decision 
made by” with an u/I person. General Arnold, CONR, was mentioned 

1034: The NMCC chronology reflects that VP fold SECDEF he had talked to the 
President VP asked if forces were on a heightened state of alert SECDEF confirmed 

1035: The NMCC chronology reflects that VP reiterated instructions to SECDEF to take 
them out. SECDEF asked who the instructions were given to VP said instructions were 
relayed from PEOC to operations center and to the Air Force 

1038: The CONR chat transcript records that VP has cleared us to intercept tracks of 
interest and to shoot them down if they do not respond, per CC [Commander, probably 
Arnold] 

1041: The NMCC chronology reflects that SECDEF told VP his is recommending 
DEFCON 3. VP told SECDEF he should confer with POTUS and let him make decision, 
but he agrees. 

1042: The CONR chat chronology clarifies that clearance to shoot from VP is to save 
lives on the ground if a/c do not respond 

1043: The NMCC chronology reflects that DDO directed conferees to wait on 
implementing DEFCON 3 

1046: The NMCC chronology reflects that DEFCON 3 is declared by VCJCS at 1046 
EDT 

1057: The NORAD Air Warning Center log reflects that CJCS directed world-wide 
DEFCON 3, CINC NORAD reviewing for appropriate actions 
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